Consumers are already familiar with the prospect of their personal data, such as email addresses, social contacts, browsing history and genetic ancestry, being harvested and often resold by apps. and the digital services they use.
With the advent of consumer neurotechnology, the data collected is becoming more and more intimate. A headband acts as a personal meditation coach by monitoring the user's brain activity. Another purpose is to help treat anxiety and depressive symptoms. Another person reads and interprets brain signals while users scroll through dating apps, presumably to provide more consistent results. (“‘Listen to your heart’ is not enough,” the manufacturer says on its website.)
The companies behind such technologies have access to users' brain activity profiles – the electrical signals that underlie our thoughts, emotions and intentions.
On Wednesday, Governor Jared Polis of Colorado signed a bill, a first in the United States, that tries to ensure that such data remains truly private. The new law, passed by a vote of 61 to 1 in the Colorado House of Representatives and a vote of 34 to 0 in the Senate, expands the definition of “sensitive data” in existing privacy laws. of the state to include both biological data and “neural data” generated by the brain, spinal cord and the network of nerves that relay messages throughout the body.
“Everything about us is in our minds,” said Jared Genser, general counsel and co-founder of the Neurorights Foundation, a science group that supported passage of the bill. “What we think and feel, and our ability to decode it from the human brain, could not be more intrusive or personal to us.”
“We are really excited to have an actual bill signed into law that protects our biological and neurological data,” said Representative Cathy Kipp, the Colorado Democrat who introduced the bill. everybody”.
Sen. Mark Baisley, the Colorado Republican who sponsored the bill in the Senate, said: “I feel really pleased that Colorado is taking the lead in addressing this issue and providing it with adequate protections for people's privacy. I am really pleased with this signing.”
This law targets consumer-level brain technologies. Unlike sensitive patient data obtained from medical devices in clinical settings, which is protected by federal health law, data surrounding consumer neurotechnology, Mr. Genser said, Use is largely uncontrolled. That vulnerability means companies could collect large amounts of highly sensitive brain data, sometimes for an unknown number of years, and share or sell that information to third parties.
Supporters of the bill expressed concern that neural data could be used to decode a person's thoughts and emotions or to learn sensitive information about an individual's mental health, such as whether someone has epilepsy or not.
“We have never seen anything with this power before — to identify and systematize people and biases,” said Sean Pauzauskie, a member of the board of directors of the Colorado Medical Association. against humans based on brain waves and other neural information.” first brought this matter to Miss Kipp's attention. Mr. Pauzauskie was recently hired by the Neurorights Foundation as medical director.
The new law extends to biological and neurological data, and similar protections are granted accordingly Colorado Privacy Act to fingerprints, facial images and other sensitive biometric data.
Among other protections, consumers have the right to access, delete and correct their data and to opt out of the sale or use of data for targeted advertising. Companies, in turn, face strict regulations on how they handle that data and must disclose what data they collect and their plans for it.
“Individuals must be able to control where that information — personally identifiable and perhaps even personally predictive information — goes,” Mr. Baisley said.
Experts say the neurotechnology industry is poised to expand as major tech companies like Meta, Apple and Snapchat enter the scene.
“It's happening rapidly but it's about to grow exponentially,” said Nita Farahany, a professor of law and philosophy at Duke.
From 2019 to 2020, investment in neurotechnology companies increased by about 60% globally, and in 2021 this amounted to about $30 billion, according to a market analysis. The industry gained attention in January, when Elon Musk announced on date X that the brain-computer interface produced by Neuralink, one of his companies, has been implanted in humans for the first time. Mr Musk has since said the patient has fully recovered and can now control a mouse with just his thoughts and play chess online.
Although extremely outdated, some brain technologies have resulted in groundbreaking treatments. In 2022, a man was completely paralyzed were able to communicate using computers simply by imagining his eyes moving. And last year, Scientists were able to to translate the brain activity of a paralyzed woman and convey her words and facial expressions through an avatar on a computer screen.
“The things people can do with this technology are amazing,” Ms. Kipp said. “But we just think there should be some protections for people who don't intend to have their minds read and their biological data used.”
That happened, according to a 100-page report released Wednesday by the Neurorights Foundation. The report analyzed 30 consumer neurotechnology companies to see how their privacy policies and user agreements align with international privacy standards. It found that all but one company meaningfully restricted access to a person's neural data, and that in certain circumstances, nearly two-thirds could share data with third-party. The two companies implied that they sold that data.
“The need to protect neural data is not tomorrow's problem – it is today's problem,” said Mr. Genser, one of the report's authors.
Colorado's new bill has won resounding bipartisan support, Baisley said, but it faces stiff outside opposition, especially from private universities.
Testifying before a Senate committee, John Seward, research compliance officer at the University of Denver, a private research university, noted that public universities are exempt from the Colorado Privacy Act 2021. The new law puts private institutions at a disadvantage, Mr. Seward testified, because they will be limited in their ability to train students who are using “commercial tools in research and neurodiagnosis” purely for research and teaching purposes.
“The playing field is not level,” Mr. Seward testified.
The Colorado bill is the first to be signed into law in the United States, but Minnesota and California are pushing similar legislation. On Tuesday, the California Senate Judiciary Committee unanimously passed a bill defines neural data as “sensitive personal information.” Several countries, including Chile, Brazil, Spain, Mexico and Uruguay, have established brain-related data protection measures in their state or national constitutions or have implemented measures to protect brain-related data. steps to do that.
“In the long term, we would like to see global standards developed,” Mr. Genser said, for example by expanding existing international human rights treaties to protect neurological data.
In the United States, supporters of the new Colorado law hope it will set a precedent for other states and even provide momentum for federal legislation. However, experts note that the law has limitations and may only apply to consumer neurotechnology companies that are collecting specific neural data to determine a person's identity, such as new law stipulates. Most of these companies collect neural data for other reasons, Ms. Farahany said, such as to infer what a person might be thinking or feeling.
“You wouldn't have to worry about this Colorado bill if you're any of those companies right now, because none of them are using them for identification purposes,” she added.
But Mr. Genser said that Colorado Privacy Act law protects any data that qualifies as personal data. He said that consumers must provide their names to purchase products and agree to the company's privacy policy, this use falls under the scope of personal data.
“Because consumers' previous neural data was completely unprotected under the Colorado Privacy Act,” Mr. Genser wrote in an email, it has now labeled sensitive personal information with Equivalent protection for biometric data is an important step forward. ”
IN parallel Colorado bill, the American Civil Liberties Union and other human rights organizations are pushing for stricter policies around the collection, retention, storage and use of all biometric data, whether identification purposes or not. If the bill passes, its legal implications will apply to neural data.
Big tech companies played a role in shaping the new law, arguing that it is too broad and risks harming the ability to collect data that is not closely related to brain activity.
TechNet, a policy network representing companies such as Apple, Meta and Open AI, has succeeded in bringing focused language to the law governing brain data used to identify individuals. But the group failed to remove language management data generated by “an individual's body or bodily functions.”
“We feel like this could be very broad for some of the things that all of our members do,” said Ruthie Barko, TechNet's executive director for Colorado and the central United States.
